Suggestion for a search to raise an alert when there is a pattern missing in the log file

[swethaJ]

Please provide sample search query for the below case:

The possibility of monitoring the logs and raise an alert when there is a pattern missing in the log file.

[inventsekar · Accepted solution]

Hi Swetha,
first you can create a search query -
index=os_nix host=hostname source=/var/log/messages "pattern-msg"

after the search query bar and just above the time-picker, you have a "Save As" down drop menu.
it will give you three options - Report, Dashboard panel, Alert. choose the 3rd one - Alert.

Scheduled Vs Real-time alerts - for alert type comparisions -
http://docs.splunk.com/Documentation/Splunk/6.4.3/Alert/AlertTypesOverview

this is for creating scheduled alerts -
http://docs.splunk.com/Documentation/Splunk/6.4.3/Alert/Definescheduledalerts

the search condition - you can choose trigger condition as "pattern match < 0" (when there is a pattern missing in the log file)

once the alert condition got matched, you can create an email notification -
http://docs.splunk.com/Documentation/Splunk/6.4.3/Alert/Emailnotification

[swethaJ]

Thank you. I will try this option